HSEC-2026-0006
Cabal deletes project source files during configure
Published Apr 8, 2026 · updated Apr 8, 2026
# Cabal deletes project source files during configure The function in removes header files from the source directory when a header with the same name exists in both the build directory and the source directory. This behavior was introduced in commit to resolve header precedence issues, as C compilers prefer relative includes over search paths. The workaround uses on source directory files, which is destructive and should not happen during a build process. While the current implementation does not follow symlinks explicitly, the deletion of source files outside of the project during a build operation is possible on Microsoft Windows.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 8, 2026 · OSV.dev
Detected
# Cabal deletes project source files during configure The function in removes header files from the source directory when a header with the same name exists in both the build directory and the source directory. This behavior was introduced in commit to resolve header precedence issues, as C compilers prefer relative includes over search paths. The workaround uses on source directory files, which i
Apr 8, 2026 · OSV.dev
Updated
# Cabal deletes project source files during configure The function in removes header files from the source directory when a header with the same name exists in both the build directory and the source directory. This behavior was introduced in commit to resolve header precedence issues, as C compilers prefer relative includes over search paths. The workaround uses on source directory files, which i
Affected
- Hackage Cabal2.2.0.0, 2.2.0.1, 2.4.0.0